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NOTE: Hand print names legibly; handwriting satisfactory for remainder. 
Indices: oO Negative x} See below 


Subject's name and aliases Character of case 


UN SOU 8 5 3 ie 


—— , — Source 


Complaint received 


CJ Personal [] Telephonic Date 03/29/1999 Time 6:00PM 


Address of Subject Complainant's address and telephone number 


ae | 
M 


Scars, marks and other data 


Employer Address Telephone 


Vehicle Description i : 


Facts of Complaint 


Subject’s 
Description 


advised he has been contacted by two reporters, 
one from “Wired Web” (name not provided) and Jim Bruner, “Seattle Times” 
who interviewed and advised that the computer virus “Melissa” is believed 
to have originated with him. has an AOL account for his home 
computer, and believes someone hacked into it creating 
a web site. work is that of aL —s—“‘”™~™—™—CcJand he has a 


hobby as a Washington So: oe He advised he had nothing 
to do with the virus and is concerned about his reputation because of it. 


He wanted to know if the FBI was working on this case and is a to 


talk with someone about_it. He provided his home telephone as 
[~Jand work phone as 


ee 
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(Fila No.) 
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NOTE: Hand print names legibly; handwriting satisfactory for remainder. 
Indices: [XI Negative [1] See below 


Subject's name and aliases Character of case 


UNSUB; CITA 


MELISSA VIRUS 
b6 
ees = 


Complaint received, 


x] Telephonic Date 3/30/99. Time_6 :30P 


Address of Subject Complainant's address and telephone number 
(Home) 


4 
$ 


Subject’s 
Description 


* Scars, marks and other data 


Monday-Thursday da ake b6 


- b7c 
Vehicle Description 


Facts of Complaint 
C advised she works in the a: ibrary & one of their computers has been b6 
affected w/the Melissa virug. C said two suspicious incidents have hs 
occurred that may be important, the first about 3/18/99 when she unlocked 
the library before it officially opened & found two men inside. One 
individual was{|  ————7>—————*“«*WEWho.- previous y_worrkeed iin 
cataloging & the othey,| ©... _oneeosworks in the 
x has advised her he has allowed ae to live with 
is a hagker, intelligent & into pornography. C went to 

who was playing chess on one of the Internet computers, to 
determine how he gained entry & found him defensive & unwilling to leave, 
which he finally did. On Thurs 3/25/99, as C was walking toward the 


library, she saw another man about] 
coming out of the library. This individual is not 


a professor or student & when asked how Do not write in this space. 

he got into the library said ‘the red. 

headed custodian let him in’. He pointed Re 
to bldgs outside the library & offered Ee 
that he worked in one of them. C does a 


not know how these indidivuals are 
gaining access to the library during 
hours when it is locked & thought these 
incidents might be connected to ‘Melissa’. 


SAS) | 


omplaint received by) 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04/01/99 


b6 
b7C 
_| After being advised of the identity of the interviewing 
agents and the nature of the interview, he provided the following 
information: 
has retained an attorne Be 
a——~bTC 
Was askéd if he wanted hi attornéy to 
be preeent: during the interview. He replied, “no, it was not ek 
necessary. oe CO an_ attorney because of all the Be 
publicity surrounding his name. wanted to discuss the fi 


case with the Federal Bureau of Investigation (FBI) to attempt to 
clear his name. anes own the .accoun 

but had nothing to do with the Melissa virus. as 
absolutely nothing to hide and wishes to cooperate. 


b6 


His home address is 
b7c 


His wife has access to his 
America On-Line (AOL) account and knows the password. Just 
recently, the log-on was set up so that it was not necessary to 
enter the password. His children have access, but only when 
supervised. Occasionally, his children surf the Disney Channel. 
With the exception of his wife’s purchases of Beanie Babies and 
books on the Internet, no other purchases have been made over the 
Internet, nor have they shared their password with anyone. They 
use one credit card for the billing of their AOL account and for 
occasional purchases. 


His computer at home is an AST, the model is known as 
Adventure, it originally contained a Pentium 75. Approximately 
one year ago he brought it to CompUSA in[s—CSCSCCS and b6 
had a chip doubler installed making it 150. It has a modem - b7c 


04/01/1999 «a Seattle, Washington 


Investigation on 


oAV B10 fo dgy9 


Date dictated 


b7C 
b7E 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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14.4 megahertz and 16 megabits of random access memory (RAM). It 
contains the Windows 95 Office Suite software package. 
still has the original package. is comfortable using 


Word and Excel. 


currently works for 
He is a Washington State licensed 


has another 
e-mail account with his employer, His e-mail 
account at work is used predominantly for inter-office purposes. 
There have been a few times when he has sent his wife quick e- 
mails regarding dinner and after school activities. a 
has never accessed either his AOL account or his account at work 
remotely. He added, he did not think he could access his 
accounts remotely. 


uses his AOL account solely for sending e- 
mails and surfing the Web. He does not visit any pornographic 
sites and has never participated in Internet Relay Chat (IRC). 


The account is still active, and he has not changed the password. 
The password isl __|plans on canceling his AOL 
account as soon as the investigation is complete. f= eal does 
not currently have/nor did he ever create a website. He 
attempted to create a websit homepage awhile back, but his 
attempts were unsuccessful. foe he not participated in 
on-line Newsgroups. He had particular interest in the Newsgroup 
but was 
unable to figure out how to sign on. deletes any junk 
mail that he receives. He occasionally receives pieces of mail 


that he cannot discern. referenced “alt” as being 
attached to some incoming e-mails. He believes it is typical to 


receive junk mail. He receives junk mail predominantly at his 
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In assessing his computer proficiency, 


admitted knowing the “basics.” He declared himself to be a 
novice. works in Word and Excel, but does not know how 
to program. took college courses in BASIC and Fortran 


computer languages. He employs a computer aided tool known as 
AutoCAD at work to help him draft engineering plans. It is self- 


contained software and requires no programming on his part. He 
compared it to Correl Draw. 
b7C 


commented that the fact that someone broke 
into his AOL account and used his name to send this virus out was 
very distressing. His company was victimized by the virus as 
well. System engineers of his company worked to resolve the 
problem for hours on Friday, March 26, 1999. 


A chronology of events was described as follows: 
first heard of his AOL address being tied to the virus b6 
on March 29, 1999 at approximately 10:00 a.m. Polly Sprenger of b7c 
Wired News called him to inquire about the “hack.”[—__Jwas 
shocked and cannot recall much of the conversation. He recalled 
hearing about the Melissa virus while driving to Idaho. He went 
to Idaho to visit a friend for the weekend. After thinking about 
the phone call, he was bothered by the fact that Sprenger had 
obtained his home phone number. He realized his information was 
most likely all over the Web. [|_|] maintained someone else 
made it look like the virus originated from him but that he had 
nothing to do with it and was not responsible for it. 


then contacted AOL via e-mail and stated that b6 
he is but that he did not create or distribute b7C 
the Melissa virus. AOL sent back an e-mail explaining how to 
remove the virus. He sent back a reply stating again that he was 
not responsible for the virus and wanted to know how to go about 
clearing his name. He was then referred to AOL’s legal group, 
where he was told it was under investigation. believes 
he has copies of the e-mails and will forward to Special Agent 
(sa) Upon arriving home on Monday at approximately 6:00 
p.m., he saw the news media on his front lawn. He then realized 
it was serious. He became very concerned and worried on how he 
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could prove he had nothing to do with it. [si immediately 
contacted the FBI at approximately 6:30 p.m. to lodge a 
complaint. He then called Channel 4 at approximately 7:00 p.m. 
to get his name out there and proclaim he had nothing to do with 
it. Channel 4 came to his home at approximately 8:00 p.m. and 
interviewed him. ZD.net contacted him and told him it looked 
similar to a virus which occurred in 1997. He continues to be 
contacted by the media. He recently was asked to fly to New York 
to appear on Good Morning America. He has not yet decided if he 
will go. 


normally receives two e-mails on average a bé 
day with his account. He is currently receiving b7c 
hundreds of e-mails, some congratulating him, others attacking 
and threatening him, and some other probing for information. 
has had his AOL account since late 1995 or early 1996. 
At the time he was working at 


He never noticed anything 
unusual in regard to his account other than the junk mail 
mentioned earlier. 


[isd does not know anyone who would do this to b6 
him. He could not reference anyone who would be angered at him. b7c 
never gave out his password. The only person with 
knowledge of his password is his wife. He brought his computer 
to COMPUSA oe Washington twice, early 1997 and 
about one year ago to install the chip doubler. He also had it 
serviced at Ballard Computer,L Washington once in 1996 
for an upgrade of some sort. He cannot recall the specific 
dates, names of the employees who serviced his machine, or 
specifics of what he had done. [___—idddhas a friend,[ | 
who serviced his computer several times for reasons such 
as: reconfiguring Windows and various games because of 
incompatibility issues, td the resolution, and adjusting 
the speaker. works atl a computer graphics 
company. also contacted AOL service representatives 
over the telephone to walk him through the installation of the 
AOL Internet software. 
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[J remarked he is willing to assist the FBI in 
any way possible. He was asked to keep the interview 
confidential, but that he could certainly discuss it with his 
attorney. When asked if he would be willing to submit to a 
polygraph examination, he replied, yes, he would in order to 
prove that he is telling the truth.” 


b3 
b6 
b7C 
b7E 


es | 


FD-320 (Rev. 4-11-86) ce] @ 


In Reply, Please Refer to 


b7E 


FBI CASE STATUS FORM 


Date: 03/01/2000 


To: IL_S. Attorney, Katrina Pflaumer, 601 TISA Tinion St Seattle, WA 
(Name and Address of USA) 


. 


From: SAC Charles EF. Mandi go 
(Name of Official in Charge and Field Division) (Signature of Official in Charge) 
RE: | | b6 
(Name of Subject) (Age) (Sex) b7c 


You are hereby advised of action authorized by 
eres AUSA) 


on information submitted by Special Agent SA . on 03/01/2000 .- 
ame, : (Wate) 
(Check One) 


[_] Request further investigation 
Immediate declination 
Filing of complaint 


Presentation to Federal Grand Jury 


Oe 


Filing of information 


[-] Other 


For violation of Title 18 , USC, Section(s) 1030 


Synopsis of case: 


Subject David Smith was arrested on 4/1/99 by New Jersey b6 
State Police, pursuant to a state of New Jersey arrest warrant. b7Cc 
Smith was charged with second degree offenses of interruption of 
public communication, conspiracy to commit the offense, third 
degree theft of computer service, and third degree damage or 
wrongful access to computer systems realting to the propagation 


of the computer virus known as "Melissa". Smith hijacked_the AOL 
account of Washington state resident] 
was Cleared early in the investigation and 


cooperated fully with the Seattle Division. AUSA 
ey Seattle, declined prosecution on this matter since 


subject Smith is being propecurcd b cate and federal 
authorities in New Jersey. 


[ __|plead guilty in December-1999. 


t{ _—__jo6immmo3 .320 


1 - Addressee 


1 - AUSA 

2 - Seattle 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/20/2001 
To: Seattle 


From: Seattle 
Squad 11 


Approved A 


Case ID #: (Closed) 
(Pending) 


Title: UNSUBS 
MELISSA VIRUS 
- VICTIM 


Synopsis: To claim appropriate accomplishment statistics. 
Details: This communication serves to document accomplishments 


associated with the above captioned case that were captured from 
3/31/1999 to 3/3/2000. 


SERIALIZED (4X FILED _ COR 
APR 2 3 2001 


FB! SEATTLE 


b3 
b6 
b7C 
b7E 


b3 
b7E 


To: Seattle From Seattle @ 
Re: Ls (03/20/2001 b3 
b7E 


Accomplishment Information: 
Number: 1 


Type: NIPCIP COMPROMISED SITE IDENTIFIED AND NOTIFIED 
ITU: NIPCIP 


Claimed By; 

SSN: 

Name: 

Squad: qua 
Number: 1 


Type: NIPCIP VICTIM CONTACTED/INTERVIEWED 
ITU: NIPCIP 
Claimed By: 


SSN: 

Name: b6 

Squad: qua Bye 
Number: 1 


Type: NIPCIP SUBJECT TOOL/EXPLOIT/MALICIOUS CODE IDENTIFIED 
ITU: NIPCIP 
Claimed By: 


SSN: 
Name: 
Squad: qua 


0791js805.542 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/23/2002 
To: Seattle 


From: Seattle 


Squad 11 
b6 
By: b7c 
Approved By Nae 
Drafted By: M:mmm 
Case ID #: (Closed) 


Title: UNSUB; 
MELISSA VIRUS; 
Computer Intrusion 
Synopsis: To claim appropriate accomplishment statistics. 


Details: This communication serves to document the 
accomplishment associated with captioned case. 


(SEARCHED. INDEXED. 
SERIALIZED... FILED 


SEP 2 8 2002 


To: Seattle Fro Seattle 
Re: 09/23/2002 


Accomplishment Information: 


Number: 1 

Type: NIPCIP VICTIM CONTACTED/ INTERVIEWED 
ITU: AGENT INTERVIEW 

Claimed By: 


SSN: 
Name : 
Squad: qua 


266mmm06 .542 
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